Paul Newman R.I.P.

Can't get much cooler than him.

Qualifications for the Ideal Pentester

From http://seclists.org/pen-test/2008/Sep/0153.html

What are the qualifications for the ideal "Penetration Tester"?

Your opinions and experiences are so much appreciated
This is likely going to differ from the normal tailored
answer you'll hear from the suit types so here goes. The
qualifications for pentesting if I were conducting the
interview would vary. I would prefer to find someone
with a thorough background in networking, systems
administration and programming.
The experience for me would have to be a few years in
an industry where the usage of those technologies
were heavy. For examply, I'd prefer to find someone
with hands on experience in say a NOC environment or
a SOC environment.
The candidate would HAVE to have hands on experience
first and foremost. I believe the at the bottom of
the line, experience outweighs any certifications
someone would have on their resume.
Secondly, I'd like to see them exposed professionally
in the security industry. In some capacity doing some
type of auditing, be it system level, network level.
For me, again, they'd have to have the technical know
how involved with systems administration as well as
with networking.
In the common tasks of a system administrator, there
are many learning curves for many systems (Windows,
Linux, BSD, etc.). There are many programs to be
learned and understood to effectively manage those
systems. There are duties including creating the
creation of accounts, group assigning, etc., this
exposes the candidate to the AAA concepts.
Networking is a must period. No network, no pentest.
I won't get into physical pentesting on this ramble.
Understanding networking is a tremendous advantage
since one needs to understand how things work from
the ground up. The candidate should be able to pick
apart layer by layer the OSI/DoD model to determine
a starting and exiting point when addressing their
penetration test.
Because I believe in a form of structured penetration
test, I feel the candidate should be a jack of all
trades on the protocols. They'd need to be well
versed to know when to perform networking related
security testing (MITM, packet injection, covert
channel testing) versus say application level
testing.
Next comes the core of understanding the protocol
itself. I'd want someone with a mixture of dealing
with security protocols. Perhaps someone having
experience configuring webservers with OpenSSL or
something along these lines. Someone whom I can
ask a quick question like say... What's are the
differences between aggressive and main modes of
VPN's? They'd need to understand what I'm talking
about and why I would ask something like this.
They'd need to be well versed on CVSS topics,
commonly used exploits, industry top 10's and 20's
as far as threats go, they'd need to understand a
few concepts related to doing paperwork as well.
This means understanding a broad but structured
view of topics such as BIA, DRM, ROI, etc., it's
a matter of preference, but the more experienced
in the subject matters even if its broadly based
I believe will get me a more professional pentest
expert on my team as opposed to someone who sat
around all day running tools.
I answered a question similar to this a week or
two ago; the need for those coming into the field
to understand the basics before solely focusing
solely on the usage of popular tools. My ideal
pentester would make his own tools a-la McGuyver
if they had to. There is no guarantee you will
always be able to use tools and many individuals
need to understand this concept. What happens
if you're at a client and they ask you right on
the spot to perform an assessment on their
machines without those fancy tools you'd swore
would find any hole. Would you know what to do
without them, would you know how to search for
open ports (lsof, netstat). Would you know the
system well enough for you to be able to perform
a pentest under those conditions.
Recap...
MUST
Networking, Systems, Applications, Security Concepts

Top 50 Quotes from Charles Barkley

50. "I can be bought. If they paid me enough, I'd work for the Klan."

49. "You got to believe in yourself. Hell, I believe I'm the best-looking guy in the world and I might be right."

48. "I don't hate anyone, at least not for more than 48 minutes, barring overtime."

47. "We better not be doing the Bulls this year. Man, they suck! Bunch of high school kids with $70 million contracts. Damn! I hate my mother for having me too soon."

46. "You can talk without saying a thing. I don't ever want to be that type of person."

45. After retiring from basketball "I'm just what America needs - another unemployed black man.

44. Ernie: "Did they recognize you in South Dakota?"
Charles: "Yes, they did. It was easy because I was the only black person there. When they see me walking down the street they say 'There he goes again'. And when I come back the next year they say 'He's back yawl!'"

43. Right after Peja won the 3-point contest: "Kenny said it was going to be an all-international night. I want to know which international brother is going to win the slam dunk contest."

42. On the Enron scandal investigation: "Almost all those politicians took money from Enron, and there they are holding hearings. That's like O.J. Simpson getting in the Rae Carruth jury pool."

41. "I had to explain to my daughter why that skank Monica Lewinski has an hour special on HBO this weekend."

40. Ernie: "Auburn is a pretty good school. To graduate from there I suppose you really need to work hard and put forth maximum effort."
Charles: "20 pts and 10 rebounds will get you through also!"

39. "Every time I think about changing a diaper, I run a little bit harder and a little bit faster to make sure I can afford a nanny until my daughter's old enough to take care of that herself."

38. EJ: "Did you graduate from Auburn?"
Charles: "No, but I have a couple people working for me who did."

37. "*** Bavetta and Moses parted the Red Sea together."

36. Ernie Johnson, on Reggie Evans being caught grabbing the rocks of Chris Kaman: "(Reggie Evans) got caught with his hand in the cookie jar."Charles Barkley: "Ernie, I don't know where you get your cookies at but the rest of us don't get ours there."

35. On his 17-year old daughter not dating yet: "Thank goodness. I just hope she doesn't start before I go in the Hall of Fame. That way, I won't have to kill anybody before I get inducted."

34. Kenny: "There's guys who go over to Europe and play overseas from America, and they dominate!"
Charles: "Those are called 'brothers'

33. After Wang has a shot blocked: "He's got to bring something stronger than that. That's like bringing milk to a bar, it's not strong enough"

32. Barkley on Turner Sports office having a betting pool on his weight: "That is starting to hurt my feelings. I don't mind skinny people making fun of me, we all do that, but I don't want fat people making fun of me."

31. "We are in the business of kicking butt and business is very, very good."

30. When the Dream Team was about to play the Angola national team, during pre-game interviews the other USA players provided diplomatic, face saving comments about how they would play hard and felt strongly they would win. When Chuck was asked about Angola and the game, he replied: "They're in a lot of trouble."

29. Charles Barkley on his thoughts about retiring before the season: "I remember sitting down with the Rockets and saying, 'Yeah. I'm going to retire.' They said, 'Well, we'll give you $9 million.' And I said, 'You got a pen on you?'"

28. Man, everything gets blamed on the Clintons, every single thing in this world. I think Bill Clinton shot JFK, too.

27. "I know why his name is DMX. Because his real name is Earl. Imagine if his name was Earl the rapper."

26. "If you go out with a girl and they say she has a great personality, she's ugly. If they tell you a guy works hard, he can't play a lick. Same thing."

25. After Kevin Garnett threw a ball into the crowd out of frustration and was ejected. They showed footage of the man that got hit by the ball being taken away in a stretcher and his daughter was crying. Charles commented that players take passes to the face all the time. He topped it off by saying: "You know why that little girl's crying? It's because she's thinking 'my daddy's a wussy'".

24. Barkley on Ernie Johnson and Kenny Smith eating a box of hot Krispy Kreme donuts in front of him: “Both of y’all are2 going to hell for that. Y’all are going to hell with a first-class ticket. Is that how you treat your partner? Krispy Kreme might be the greatest invention in the history of civilization when they’re hot. Y’all are cruel man.”

23. "It's kinda great to see the Celtics doin well again cuz that was so much fun in my day to go to the Boston Garden and they spit at you and throw things at you and talk about your mom. It sounds like dinner at Kenny Smith's house."

22. "I think that the team that wins game five will win the series. Unless we lose game five."

21. Charles Barkley after seeing a picture of Sam Cassell on the screen: "Phone home." And later he remarks to Kenny, "Sam Cassell is a good guy, but he's not going to wind up on the cover of GQ anytime soon."

20. While watching someone in Australia put $1 million worth of rubies on a table: "Damn, must not be any black folks in Australia. You can't just leave $1 million worth of jewelry lying around the 'hood."

19. Asked if he had ever been in the governor's office in Montgomery, Barkley said no. "They don't let many black people in the governor's mansion in Alabama," he said, "unless they're cleaning."

18. On the goal of the '92 Olympic Dream Team when playing Panama in the Tournament of the Americas: "To get the Canal back."

17. To Kenny: "Hakeem couldn't kick your ass cuz you were too close, kissin his!"

16. Barkley on Hanno Mottola, who, as EJ remarked "is the first NBA player from Finland". Charles replies: "Of course he is the first NBA player from Finland, he's the only person in Finland."

15. On supersized Oliver Miller: "You can't even jump high enough to touch the rim, unless they put a Big Mac on it."

14. "All I know is, as long as I led the Southeastern Conference in scoring, my grades would be fine."

13. On North Carolina missing 22 of its last 23 shots in losing to Georgetown in the NCAA tournament last weekend: "Stevie Wonder could make one of 23 shots."

12. I'd never buy my girl a watch... she's already got a clock over the stove.

11. "I always laugh when people ask me about rebounding techniques. I've got a technique. It's called just go get the damn ball."

10. On the Portland Trail Blazers (back when they were known as the Jail Blazers) serving Thanksgiving meals: "In between arrests they do community service."

9. "Yeah Ernie, its called defense, I mean I wouldn't know anything about it personally but I've heard about it through the grapevine.

8. "Well, when I went off to college, the guys I used to hang with were pumping gas and voting Democrat. Today they're still pumping gas and voting Democrat. Guess the Democrats didn't do much for them."

7. "When I was recruited at Auburn [university], they took me to a strip joint. When I saw those titties on Buffy, I knew that Auburn met my academic requirements."

6. "Hey Stanley, you could be a great player if you learned just two words: I'm full."— Barkley yelling to 300-plus-pound Houston Rockets teammate Stanley Roberts

5. "I heard Tonya Harding is calling herself the Charles Barkley of figure skating. I was going to sue her for defamation of character, but then I realized I have no character."

4. On the All-Star Game: "Hell, there ain't but 15 black millionaires in the whole country & half of 'em are right here in this room."

3. On Jerry Krause still being able to keep his job as GM of the Chicago Bulls: "Jerry Krause must have pictures of his boss's wife having sex with a monkey."

2. After throwing a guy through a 1st floor window in a bar Charles was in front of the judge.
Judge: "Your sanctions are community service and a fine, do you have any regrets?"
Charles: "Yeah I regret we weren't on a higher floor"

1. After an Olympic Dream Team victory over Angola, in which they won 116-48, Charles got into a physical altercation with a member of Angola towards the end of the game, afterwards he says: "Somebody hits me, I'm going to hit him back. Even if it does look like he hasn't eaten in a couple weeks. I thought he was going to pull a spear on me."

This guy is great.

TMac's Best Quotes

Courtesy of clutchcity.net

"It's on me."
"It's my fault some people ordered Heneiken but got budweiser. Im sorry. "
“I don’t believe in pressure. Pressure doesn’t affect me at all.”
"I know I have to keep up my image. It's all about how you handle the situation."
“I work on my game daily. Because I’m never satisfied, never going to be.”
"I just couldn't afford for us to lose this game, so I had to impose my will on it."
"I try, man, I try."
"I'll make Stromile an All-Star."
"We got Steve Francis? For real?"

Ron Artest

Yeah its about time we got some heart (and crazy) back in H-Town. I present to you my new favorite Rocket.

"His punches are just too fast"

link

Italian Aerobics

First post this year and it's a good one...

wireless card

Just so I don't forget, here are the specs on my wireless card:

Buffalo wli-cb-g54hp
Driver : bcm43xx
Chipset : Broadcom BCM43xx

R.I.P. Pimp C

Chad Butler (December 29, 1973 – December 4, 2007)

How RSA tokens work

First post in a series (hopefully) related to general computer security.

When I first started my current many years ago I was issued of these keyfob thingies which displayed a 6 digit number that changed every minute. I just blindly accepted that it did some complex random number generation that allowed me to log in to systems securely.

Here's how it works (paraphrased from this).

The token is a completely standalone unit. It does not have any sort of connection to any other electronic device.

Each token contains a clock chip and a unique seed number, which I assume is displayed on the back of the token.

Every minute, the combination of the current time and the unique seed number as input of the algorithm and produces the six digit number you see on the token (I have no information on the algorithm itself).

The server performing the authentication (known as an ACE Server) knows your unique seed number, the algorithm being used, and the time. With this information, it performs the same function on the server. It receives your code and compares it to the code it computes. If the codes match you are authenticated.

Edit:
I found a more detailed breakdown after the original post is here:

All versions of the SecurID use RSA's patented
technology to synchronize the use of Current Time in a SecurID token and
its remote authentication server, what RSA calls the
ACE/Server. (Typically, as you know, the link between the token-holder and
the ACE/Server is through an intermediary -- an ACE/Agent or RADIUS agent
-- which intercepts an authentication call and relays it to the ACE/Server
for processing.)

The classic SecurID, for 15 years, used a proprietary algorithm to
hash a token-specific 64-bit seed and Current Time. The new SecurID --
introduced at the beginning of 2003 -- uses the AES block cipher, in
standard ECB mode, to hash:

- a 128-bit token-specific true-random seed,
- a 64-bit standard ISO representation of Current Time
(yr/mo/day/hour/min/second),
- a 32-bit token-specific salt (the serial number of the token), and
- another 32 bits of padding, which can be adapted for new functions or
additional defensive layers in the future.

Conflated and hashed by the AES, these inputs generate the series
of 6-8 digit (or alphanumeric) token-codes that are continuous displayed on
the SecurID's LCD, rolling over every 60 seconds. (The standard mode of
use, as you know, requires two-factor authentication: the token-holder is
required to provide both a SecurID token-code and a user-memorized PIN to
the remote ACE/Server.)

ECB mode in AES is executed on 128-bit blocks, of course, so it is
obvious that RSA had to pad the standard 64-bit expression of Current Time
with another 64 bits. Using a token-specific salt blocks any attempt to
pre-calculate a library of possible token-codes for all 128-bit seeds. That
means that any brute-force attack on the AES SecurIDs would have be focused
on a particular token.

Gold Digger Pwned

I know everyone has probably linked to this craislist listing and there's a good reason for it... It rules.

What am I doing wrong?

Okay, I'm tired of beating around the bush. I'm a beautiful (spectacularly beautiful) 25 year old girl. I'm articulate and classy. I'm not from New York. I'm looking to get married to a guy who makes at least half a million a year. I know how that sounds, but keep in mind that a million a year is middle class in New York City, so I don't think I'm overreaching at all.

Are there any guys who make 500K or more on this board? Any wives? Could you send me some tips? I dated a business man who makes average around 200 - 250. But that's where I seem to hit a roadblock. 250,000 won't get me to central park west. I know a woman in my yoga class who was married to an investment banker and lives in Tribeca, and she's not as pretty as I am, nor is she a great genius. So what is she doing right? How do I get to her level?

Here are my questions specifically:
- Where do you single rich men hang out? Give me specifics- bars, restaurants, gyms
-What are you looking for in a mate? Be honest guys, you won't hurt my feelings
-Is there an age range I should be targeting (I'm 25)?
- Why are some of the women living lavish lifestyles on the upper east side so plain? I've seen really 'plain jane' boring types who have nothing to offer married to incredibly wealthy guys. I've seen drop dead gorgeous girls in singles bars in the east village. What's the story
there?
- Jobs I should look out for? Everyone knows - lawyer, investment banker, doctor. How much do those guys really make? And where do they hang out? Where do the hedge fund guys hang out?
- How you decide marriage vs. just a girlfriend? I am looking for MARRIAGE ONLY
Please hold your insults - I'm putting myself out there in an honest way. Most beautiful women are superficial; at least I'm being up front about it. I wouldn't be searching for these kind of guys if I wasn't able to match them - in looks, culture, sophistication, and keeping a
nice home and hearth.

it's NOT ok to contact this poster with services or other commercial interests
PostingID: 432279810

THE ANSWER
Dear Pers-431649184:

I read your posting with great interest and have thought meaningfully about your dilemma. I offer the following analysis of your predicament.

Firstly, I'm not wasting your time, I qualify as a guy who fits your bill; that is I make more than $500K per year. That said here's how I see it.

Your offer, from the prospective of a guy like me, is plain and simple a crappy business deal. Here's why. Cutting through all the B.S., what you suggest is a simple trade: you bring your looks to the party and I bring my money. Fine, simple. But here's the rub, your looks will fade and my money will likely continue into perpetuity...in fact, it is very likely that my income increases but it is an absolute certainty that you won't be getting any more beautiful!

So, in economic terms you are a depreciating asset and I am an earning asset. Not only are you a depreciating asset, your depreciation accelerates! Let me explain, you're 25 now and will likely stay pretty hot for the next 5 years, but less so each year. Then the fade begins in earnest. By 35 stick a fork in you!

So in Wall Street terms, we would call you a trading position, not a buy and hold...hence the rub...marriage. It doesn't make good business sense to "buy you" (which is what you're asking) so I'd rather lease. In case you think I'm being cruel, I would say the following. If my money were to go away, so would you, so when your beauty fades I need an out. It's as simple as that. So a deal that makes sense is dating, not marriage.

Separately, I was taught early in my career about efficient markets. So, I wonder why a girl as "articulate, classy and spectacularly beautiful" as you has been unable to find your sugar daddy. I find it hard to believe that if you are as gorgeous as you say you are that the $500K hasn't found you, if not only for a tryout. By the way, you could always find a way to make your own money and then we wouldn't need to have this difficult conversation.

With all that said, I must say you're going about it the right way. Classic "pump and dump."

I hope this is helpful, and if you want to enter into some sort of lease, let me know.

NFS - Topic #1

Topic #1

1) On the server, the port mapper starts (usually by the server upon boot).
2) On the server, the mountd (sometimes known as rpc.mountd) starts and open one ephemeral TCP port and one UDP port. It registers these newly opened ports to the port mapper.
3) On the client, the mount command issues an RPC call to the port mapper on the server to obtain the port number for the mountd daemon.
4) The server replies back with the port number.
5) On the client, the mount command issues an RPC call to the mount daemon to mount a filesystem on the server. This is where validation happens.
6) On the server, the mount daemon replies with the file handle for the given filesystem.
7) On the client, the mount command issues the mount system call to associate the file handle to the mount point on the client.

- The NFS server privides 15 procedures in the form of procedure calls.

- TCP or UDP capability

One Skill A Day

I'm going to try something new to beef up my arsenal of skills before I start looking for a new job. Each day I'm going to learn one new tech skill. The topics will not follow any particular pattern or will not stick to one technical area. Rather, I'll probably jump around between disparate topics. That'll prevent me from getting bored.

In this blog I will type out a brief synopsis of what I learned in addition to key concepts. Some topics will obviously take more than one day to even learn the basics.

If I miss a day I'll will learn two things the next day.

Here are a few topics I want to brush up on:

1) NFS
2) XEN
3) VxFS
4) Performance Tuning
5) IP Subnetting
6) DB queries
7) Basic Oracle Admin
8) netstat usage

the brand, the image, the logo

Go Bag Revisited

I've been obsessively adding and removing stuff. Here's what I still need:

1) A new bag (looking at Ogio, The Northface, Supreme)
2) Ibuprofen
3) Multifunctional space pen
4) Bandaids (2) and small tube of antibiotic ointment
5) Ziploc containing spare change
6) Vitamins
7) Caffeine Mints
8) Pictures
9) Laptop Lock
10) Keycatcher
11)

Remember This (Re: Kids)

Do you ever notice when you're genuinely happy and you smile at your son he almost always smiles back with the same genuine fervor?

Do you notice when your attitude is very positive your daughter always responds back with the same positivity despite being in the midst of a tantrum?

It never fails.

It's like these kids (pre-3 yr old as far as I know) possess an innate bullshit detector that we all lose as we get older. Actually we don't lose it but it transforms into different type of BS detector --one that detects layers and layers of bullshit, I guess.

What does that tell you?

If you desire a specific positive behavior from a child (good temperment, good grades, etc) you must be true to them. And that means you can't pretend you've been doing positive things when you've really been out there with your homies snorting coke or screwing whores. A consistency between what you've actually been doing and what you want to present yourself as been doing needs to exist and needs to be legit.

Kids can see through your charlatan ass.

Keep it real, always.

Lead by example.

Job Opening at Ning

Lately, I've been hyping up Marc Andreessen's new company, Ning, to many of my tech savvy friends. My argument is that everyone of his creations have changed the world (the first web browser) or at least changed (or will change) the IT world (Opsware).

They all think I'm talking out of my ass. So here it is for the record:

Ning (or whatever it evolves into) is my prediction for the next big thing.

And here is an open req they have open that fits my skillset (although I haven't done Sysadmin work in years).

Here it is in its entirety in case they take it down one day:

Unix/Linux System Administrator Profile

* You love the operations of online services and Internet start-ups. You love the thrill of a 24/7 infrastructure that’s always changing.

* You have experience with online services run at scale or would like to.

* You don't mind being on-call. It sort of reminds you of college.

* You've stayed at a few companies for enough time to see an infrastructure evolve over time. You've also had alot of different projects within that environment.

* You are an expert in Solaris and Linux systems. You have experience with DTrace, Zones and Xen.

* You’ve spent a lot of time with storage management, such as SAN and NFS. If you’ve spent time with iSCSI that’s also a plus. ZFS experience? Another big plus.

* You know your way around database and network administration. You consider your time with Oracle, Cisco and Force10 time well spent.

* You love a solid night of system performance tuning, troubleshooting and problem solving.

* You started in operations because you were curious about how you manage a data center with thousands of servers. You’re constantly looking for the most efficient ways to do so. Some might call it lazy. We call it smart.

* Google isn’t your main source of information. You love spending a lot of time online and staying up-to-date on new things in infrastructure via a variety of favorite blogs.

* You are equally comfortable building everything yourself as you are with buying shrink wrapped software. You aren’t religious about either path, but instead look for the right tool for the job.

* You are independent, but not so independent that you don't enjoy working on a great team.

* You graduated from a university, ideally with a technical degree. If you didn’t graduate from a university with a technical degree, your hands on experience will blow our minds and we’ll forget about school.

* You choose simplicity, iteration and continuous improvement over ivory tower, complex architecture projects.

* Before you send in your resume, you create a social network on Ning. In doing so, you want to know how the heck we’re going to scale to millions of social networks. And the thought of which is already getting you pretty jazzed.

Go Bag

Probably influenced by this Lifehacker article, I've been thinking about building the Ultimate Go Bag. It would comfort me knowing I could jump out of bed grab this said bag and diffuse a bomb then pwn some NSA servers at any given time. Here's what I would need. This list will be updated frequently.

1) Quad-function space pen
2) Victorinox Cybertool 41
3) Toothbrush
4) Toothpaste
5) Moleskine
6) Notebook computer
7) USB thumb drive
8) Flask
9) Cliff Bar
10) Ibuprofen
11) Carabiner
12) Keys
13) Wallet
14) Mobile Phone
15) Blackberry
16) Knife
17) tiny first aid kit (antibiotic ointment, bandaid)
18) Kleenex
19) Gum
20) Laptop lock
21) Claritin
22) Ipod
23) earphones
24) maglite mini flashlite
25) cough drops
26) mints
27) hipster PDA
28) lip balm
29) camera with usb cable
30) business cards
31) pictures
32) sharpie markers
33) highlighter
34) vitamins
35) pencil with eraser
36) dental floss
37) spare change in a altoids can
38) All purpose boot CD *
39) Extra phone and blackberry batteries
40) bluetooth headset
41) ethernet cable *
42) sunglasses
43) stamps
44) universal charger
45) extra contacts
46) Verizon PC5740 Wireless adapter card
47) Tiny post-it notes
48) Notebook AC adapter
49) Caffeine mints
50) Lighter
51) Cigs
52) Ogio or Northface bag (light one with more pockets)


Ninja Jump Kit

1) Blank CDs/DVDs
2) OTS cable
3) Tiny Network Hub
4) Crossover ethernet adapter
5) Keycatcher
6) Western Digital passport USB hard drive (2)
7) Ethernet Loopback Adapter
8) Ethernet LinkCheck
9) Flexible Shaft Ratcheting Screwdriver
10) Workstation Repair Kit
11) Analog notebook
12) digital voice recorder
13) soldering iron
14) USB Floppy Drive
15) Torx Screwdrivers
16) Universal wire stripper/crimping tool
17) IDE/SATA to USB Converter
18) Yaesu handheld

Inspiring Post on Success

from DrFrylock a post on the RMMB

Heed these words my man...

Succeeding, in my experience, takes a number of factors, all playing into one another.

Willingness to fail: The difference between a successful person and an adequate person is, ironically, that the successful person has fucked up about a hundred times more. You have to be willing to fail a hundred times before you succeed. I think most people think that "tenacity" and "perseverance" are synonyms for "doing something for a long time." They are not. They mean fucking up until you succeed. The problem is that a lot of neophytes see experienced people, who don't fuck up very often and show remarkable insight and assume they were always that way. Of course they weren't. They had hundreds of fuckups too, although probably many years ago. In my case, I was lucky and got to do eight years of fucking up before I even got to college. Now, I don't fuck up very often. When I do, it's more minor, and I'm very good at covering it up until I fix it. If I want I can usually look pretty infallible. When it's advantageous to do so, of course.

Self-esteem: This country has a serious self-esteem problem, especially in women. There has been a slow but substantial change in attitudes about self-esteem. We have all heard about the trend in little league sports to not keep score, not to identify winners and losers. There is a hypothesis hanging in the air that self-esteem can be built through simply trying at something. Then, we can avoid all those messy failures, and the bad feelings that go along with them. We can instead focus on encouragement, and everybody likes effort and encouragement, right? The problem is, the hypothesis is wrong. Effort and encouragement are not enough to cultivate self-esteem. Self-esteem is built through overcoming real challenges and failures. It comes from success in spite of real adversity. Societally, we moved from being a nation of asshole fathers that simply humiliated our kids into overcoming adversity "for their own good" to a nation of nurturing mothers where nobody ever has to feel bad and everyone is special in their own way. We need something in the middle, but we haven't found it yet.

Willingness to sacrifice: You can't have it all. You can't be a partner at a top 50 law firm and have copious free time. You can't be a straight-A student and party every night. You can't kick it with your friends and gain work experience at the same time. Sometimes, you have to go all out to pursue a dream, and that means letting other things go by the wayside. I graduated college with something like a 3.97 GPA. I held a part-time job all four years. To do that, I consciously chose to give up the social aspects of the college experience. I did not have the time nor (more importantly) the energy to do it all. I have no great "man one time this party got SO out of hand" stories. I have no "dude this chick from my anthro class and I hooked up and we didn't leave the dorm room ALL weekend" stories. None. Nothing even remotely like that. Oh, I'm not socially retarded. I don't drool and my T-shirts are remarkably free of Cheeto stains; there's a point at which too much sacrifice retards success. But there's a lot of leeway in between. However, as you get older and you pursue greater degrees of success, you must be honest with yourself about sacrifices. It is very, very hard to be a world-class success in something and have a great family life. If you look back at the history of most professions, I bet you'd find a strong correlation between extreme success and divorce rates.

Willingness to learn: Collectively, we still haven't figured out quite how to handle higher education. The European system, in which students are assessed and then forever consigned to their fate in the factory, a vocational school, or a real university, isn't quite right. There's a class-ist, demeaning aspect to it. It's worse in places like India. The American system isn't quite right either. Here, thanks to a combination of community colleges, an overabundance of four-year colleges and universities, liberal arts majors, and living at home for seven years, even Forrest Gump could manage a Bachelors degree. It's certainly more egalitarian, but at what point is education diluted beyond recognition? How many Forrest Gumps with degrees does it take before everyone else's is devalued? This dilution is the grappling hook with which the vocal anti-intellectuals in America hold on to their argument that formal education is overrated. (Our postgraduate systems, on the other hand, are excellent, but those affect a much smaller number of people).

The relationship of education and learning to success is simple: to be truly successful at any established activity, craft, or profession, there is a corpus of knowledge that you must not only be exposed to, but study and internalize. A formal education at a good university will expose you to that corpus of knowledge and attempt to compel you to study it. Internalizing it is a separate issue, and that cannot be compelled. This is why so many industrial practitioners are constantly complaining that students fresh out of college "still don't know anything" and have to be trained extensively on the job. This is because in many professions, you have to practice with the corpus of knowledge to internalize it. As any anti-intellectualist will tell you, you don't need a university to learn. However, what they don't generally understand is that whether a university is involved or not, you have to study and internalize the same things. Making a go of it on your own is rewarding but awfully hard, and you have a much better chance of missing something important.

In any case, you will likely find that (with the exception, perhaps, of prodigies) that the most successful people in any activities are sponges. They study, understand, and internalize all the information that flows past them, and they seek out more. They develop expertise in related areas that aren't necessarily their focus. This enables them to make connections between things that aren't obvious to the less studious, and often appear as "left field" insights when in reality they are simply natural consequences of a breadth of knowledge.

Willingness to push limits: Being successful is about having a keen understanding of one's own limitations and also pushing beyond them. This is uncomfortable, often stressful, and sometimes (but not always) risky. Risk is an element of any success, but there are good risks and bad ones. When presented with any new endeavor, ask yourself: "is this primarily an opportunity or primarily a risk?" If it's an opportunity, you will generally do well to take it. If it is primarily a risk, greater care must be exercised. There is no greater self-esteem boost, no straighter path to success than to attempt something that you don't know you can do and then accomplish it. Do this often enough, and with a little luck you will eventually have the chance to do something that might even be impossible. Accomplish that and you get a small taste of transcendence.

Willingness to collaborate: "It's not what you know, it's who you know." This phrase, occasionally preceded generously by "Sometimes," is one of my least favorite sentences in the English language. It has a core of truth surrounded by a worm-infested husk of anti-intellectualism. If this were really true, the only criteria for success in life would be membership in a fraternity. As I pointed out above, ignoring what you know is fatal to real success. If you are smart and inquisitive and a little ambitious, you will have the opportunity to interact with other successful people that can be facilitators and role models in your life. It's a virtual certainty. The question for you is: will you cultivate these relationships or not? Being a team player and learning from others (while they also learn from you) is a critical catalyst to success. You will see indirect but substantial gains in your life if you are respectful of the people who know more than you, and generous with those who know less than you. Becoming very successful does not mean you have to be a diva, and 'diva' is (or should be) an entirely derogatory term.

Setting realistic, incremental, and motivating goals: If you don't decide what you want to happen in your life, nothing probably will. Nobody ever got successful sitting on their ass playing Xbox and waiting for something to happen. It won't. You are not the Chosen One and there is no Ancient Prophecy written about you. On the other extreme, having your only goal be to be 1) President 2) a major-league sports star 3) a rock star or 4) famous in any way is even stupider. Those aren't goals, those aren't ambitions, those are crack-pipe dreams. If you want to have one of those in the back of your head, fine. Here's something a little bit more localized: look at the people around you who are one step closer to your eventual goal than you are. These are people with whom you should be able to associate directly. Figure out how to achieve that level of success, and then go from there. Life is a ladder, not a teleportation device. Very few successful people skip intermediate steps, no matter how lucky they are or how many people they associate with.

My Learning Style

(From this site)

The results of sun tzu's learning inventory are:

Visual/Nonverbal 30 Visual/Verbal 36 Auditory 11 Kinesthetic 19

Your primary learning style is:

The Visual/ Verbal Learning Style


You learn best when information is presented visually and in a written language format. In a classroom setting, you benefit from instructors who use the blackboard (or overhead projector) to list the essential points of a lecture, or who provide you with an outline to follow along with during lecture. You benefit from information obtained from textbooks and class notes. You tend to like to study by yourself in a quiet room. You often see information "in your mind's eye" when you are trying to remember something.

Learning Strategies for the Visual/ Verbal Learner:

To aid recall, make use of "color coding" when studying new information in your textbook or notes. Using highlighter pens, highlight different kinds of information in contrasting colors.

Write out sentences and phrases that summarize key information obtained from your textbook and lecture.

Make flashcards of vocabulary words and concepts that need to be memorized. Use highlighter pens to emphasize key points on the cards. Limit the amount of information per card so your mind can take a mental "picture" of the information.

When learning information presented in diagrams or illustrations, write out explanations for the information.

When learning mathematical or technical information, write out in sentences and key phrases your understanding of the material. When a problem involves a sequence of steps, write out in detail how to do each step.

Make use of computer word processing. Copy key information from your notes and textbook into a computer. Use the print-outs for visual review.

Before an exam, make yourself visual reminders of information that must be memorized. Make "stick it" notes containing key words and concepts and place them in highly visible places --on your mirror, notebook, car dashboard, etc..